WO2010048874A1

WO2010048874A1 - Method, device and system for identifying ip session

Info

Publication number: WO2010048874A1
Application number: PCT/CN2009/074628
Authority: WO
Inventors: 郑若滨
Original assignee: 华为技术有限公司
Priority date: 2008-10-31
Filing date: 2009-10-27
Publication date: 2010-05-06
Also published as: US20110202670A1; EP2346217B1; EP2346217A4; CN101729500A; CN101729500B; EP2346217A1

Abstract

A method, a device and a system for identifying IP session are disclosed by the present invention embodiment. The method includes the following steps: according to the preset rules for generating IP session Identity (ID), the IP session ID is generated for the IP session during the authentication process and/or the IP address allocating process; the received IP session message is filtered according to the IP session ID. By performing the technique solution of the present invention, it achieves an effect that the IP session sets up the coupling relationship during the data communication process and the authentication process/the IP address allocating process and the security of the IP session is enhanced.

Description

IP session identification method, device and system

This application claims priority to Chinese Patent Application No. 200810172313.X, entitled "IP Session Identification Method, Apparatus and System", filed on October 31, 2008, the entire contents of which are incorporated by reference. Combined in this application. Technical field

The present invention relates to the field of communications technologies, and in particular, to an IP session identification method, apparatus, and system. Background technique

In the access network, an Internet Protocol (IP) session represents a network access connection session associated with the IP address of a Subscriber/user device, an IP Session and a point-to-point link layer. A Point-to-Point Protocol Session (PPP Session) is a peer. A Subscriber Session is a general term for an IP Session and a PPP Session. The PPP Session uses a unique PPP survival detection mechanism. The version 4 IP protocol (IP vision 4, IPv4) session uses the unique Bidirectional Forwarding Detection (BFD)/Address Resolution Protocol (ARP) to survive. Detection mechanism.

The IP Session is usually terminated on an IP Edge device, such as a Broadband Network Gateway (BNG)/Broadband Remote Access Server (BRAS). The other side of the IP Session is usually in the user. The device is terminated, for example, by a home gateway (HGW) or a user equipment (UE) after the HGW, that is, the IP session is a session connection established between the user equipment and the IP edge device.

The IP session is used by the network to manage the user access network, such as billing and status. In the process of implementing the present invention, the inventor has found that the prior art has at least the following problems: The data communication process of the prior art IP Session has no coupling relationship with the authentication process/IP address allocation process, and is easy to appear although the authentication is passed, but in the IP Session. During the data communication process, the attacker may still spoof the identity of the attacker by forging an IP address or a MAC address, and there is a big security risk. Summary of the invention

An embodiment of the present invention provides an IP session identification method, apparatus, and system, which implements filtering of an IP session by checking whether an IP session identifier generated according to a preset rule is added in an IP session, thereby enabling an IP session to be in a data communication process. Establish a coupling relationship with the authentication process/IP address allocation process to improve the security of the IP session.

To achieve the above objective, an embodiment of the present invention provides an IP session identification method, which includes the following steps:

Generating an IP session identifier for the IP session in the authentication process and/or the IP address allocation process according to the preset IP session identifier generation rule;

The received IP session packet is filtered according to the IP session identifier.

On the other hand, an embodiment of the present invention further provides a network gateway, including:

a generating module, configured to generate an IP session identifier for the IP session in the authentication process and/or the IP address allocation process according to the preset IP session identifier generation rule;

The processing module is configured to filter, according to the IP session identifier, the received IP session packet. On the other hand, an embodiment of the present invention further provides an IP session processing system, including a user equipment and a network gateway:

The user equipment is configured to receive an IP session identifier generation rule sent by the network gateway, generate a corresponding IP session identifier according to the IP session identifier generation rule, and send an IP session packet to the network gateway; The network gateway is configured to set the IP session identifier generation rule, and send the IP session identifier generation rule to the user equipment, according to the IP session identifier generation rule in an authentication process and/or an IP address allocation process. Generating an IP session identifier for the IP session, and filtering the IP session according to the IP session identifier.

The technical solution of the embodiment of the present invention has the following advantages, because the method for filtering the IP session is implemented by verifying whether the IP session identifier generated according to the preset rule is added in the IP session, thereby achieving the IP session in the data. The communication process establishes a coupling relationship with the authentication process/IP address allocation process to improve the security of the IP session. DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without paying any creative work.

FIG. 1 is a schematic flowchart of an IP session identification method according to Embodiment 1 of the present invention; FIG. 2 is a schematic flowchart of an IP session identification method according to Embodiment 1 of the present invention; A schematic diagram of a structure of an IP session processing system; FIG. 4 is a schematic flowchart of a method for identifying an IP session in a dynamic IPv6 session according to Embodiment 3 of the present invention;

FIG. 5 is a schematic flowchart of another method for identifying an IP session in a dynamic IPv6 session according to Embodiment 4 of the present invention;

6 is a schematic flowchart of another method for identifying an IP session in a dynamic IPv6 session according to Embodiment 5 of the present invention;

FIG. 7 is a schematic flowchart of another method for identifying an IP session in a dynamic IPv6 session according to Embodiment 6 of the present invention; FIG. 8 is a schematic flowchart of another method for identifying an IP session in a dynamic IPv6 session according to Embodiment 7 of the present invention;

FIG. 9 is a schematic flowchart of an IP session identification method in a static IPv6 session according to Embodiment 8 of the present invention. detailed description

The embodiment of the invention provides an IP session identification method, device and system. The specific content of the technical solution is: setting an IPv6 Session Identity (ID) field in an IPv6 Flow Label, or setting an IPv6 Session ID field (for example, an IPv6 address prefix) in an IPv6 address, IPv6 After the user ID/IP address allocation process succeeds, the Session ID is generated according to the rules agreed by the Subscriber and the operator to implement the coupling between the IPv6 Session and the authentication process/IP address allocation process.

The IPv6 session ID remains unchanged during the lifetime of the IP session. The BNG filters the IPv6 session ID of the received packets to prevent the attacker from spoofing IP addresses or MAC addresses. This ensures the security of shared media access.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

FIG. 1 is a schematic flowchart diagram of an IP session identification method according to Embodiment 1 of the present invention, where the method includes the following steps:

Step S101: The network gateway generates an IP session identifier for the IP session in the authentication process and/or the IP address allocation process according to the preset IP session identifier generation rule.

Specifically, for convenience of description, an IPv6 session (IPv6 Session) is taken as an example in the embodiment of the present invention. However, it should be further pointed out that other sessions that meet the requirements of the implementation scenario of the embodiment of the present invention also belong to the protection of the present invention. Scope, this point applies in the full text, and will not be heavy in the following Re-emphasis.

IPv6 Session is divided into dynamic IPv6 Session and static IPv6 Session.

Dynamic IPv6 sessions can be dynamically created and terminated. Static IPv6 sessions can only be statically configured.

The technical solution of the embodiment of the present invention is to set an IPv6 Session ID field in an IPv6 Flow label or an IPv6 Session ID field (for example, an IPv6 address prefix) in an IPv6 address. For the dynamic IP session, an IP session identifier can be generated for the IP session during the authentication process and the IP address allocation process, specifically: the authentication session ID and the dynamic host allocation protocol execution identifier (Dynamic Host Configuration Protocol Transaction ID, DHCP Transaction ID, xid The IPv6 session ID field of the IPv6 Flow label is generated according to the agreed rules, and the IPv6 session ID is generated. For the dynamic IP session, the IP session identifier can be generated for the IP session during the authentication process or IP address allocation process, specifically: Subsriber The IPv6 address prefix of the Prefix Delegation (PD) or the Stateless Address Auto Configuration (SLAAC) is then used as the IPv6 session ID. The IPv6 address prefix of the Subsriber is bound to the IPv6 session. set. For a static IP session, an IPv6 session ID can be generated according to the agreed rules according to the IPv6 address/IPv6 address prefix.

Based on the IPv6 session ID (for example, an IPv6 address prefix), the IP edge node can authorize the IPv6 session according to the IPv6 session ID. The authorization of the IPv6 session usually uses authentication, authorization, and accounting (AAA). The protocol is implemented. The IPv6 session ID (for example, an IPv6 address prefix) can be carried in the AAA message of the IPv6 session.

The IPv6 session ID is generated. The dynamic IPv6 session can be dynamically configured to the user device before the IPv6 session is established. After the authentication/IP address is successfully assigned, the device can be dynamically configured to the user device through the authentication protocol/DHCP. For a static IPv6 session, IPv6 Session ID generation The rule may be statically configured, that is, before step S101, the following two cases are also included: When the IP session is a dynamic IP session, an IP session identifier generation rule is set in the network gateway, and an authentication confirmation message or an address assignment is sent to the user equipment. In response to the message, setting an IP session identifier generation rule in the user equipment;

When the IP session is a static IP session, the IP session identifier generation rule is set on the network gateway and the user equipment.

Corresponding to the above two cases, the specific content of step S101 is also divided into two cases: When the IP session is a dynamic IP session, the rule is generated according to the preset IP session identifier, and the prefix is assigned according to the address assignment or notified by the router. The IP session address prefix obtained by ( router advertisement, RA ), or the authentication identifier in the authentication confirmation message, or the execution identifier in the address allocation response message, generates IP for the IP session during the authentication process and/or IP address allocation process. Session ID; When an IP session is a static IP session, an IP session is generated for the IP session in the IP address allocation process according to the preset IP session ID generation rule and the IP session address or IP session address prefix preset in the user equipment. Logo.

It should be further noted that, when the IP session is a dynamic IP session, after the IP session identifier is generated according to the execution identifier in the address allocation response message, the following steps are also included:

When the IP address allocation result of the IP session is updated, the IP session identification rule is generated according to the preset IP session identifier, and the updated IP session identifier is generated for the IP session according to the execution identifier in the updated address allocation response message.

The IPv6 session ID does not change during the IP session lifetime.

The IPv6 session is marked by the IPv6 Session ID.

Step S102: Filter the received IP session packet according to the IP session identifier.

Further, when the IP session is a dynamic IP session, the foregoing method further includes:

When the IP session is terminated, the IP session ID is released.

Further, in the application ring* of the foregoing step S102, as shown in FIG. 2, the following steps may be included: Step S201: The network gateway generates an IP session identifier for the IP session in the authentication process and/or the IP address allocation process according to the preset IP session identifier generation rule.

This step is the same as the specific description of step S101, and the description is not repeated in this embodiment.

Step S202: The network gateway determines whether the IP session identifier and the MAC address of the user equipment or the access port meet the preset binding relationship table.

In this step, the network gateway determines whether the MAC address of the user equipment or the correspondence between the access port and the IP session identifier is consistent with the information in the preset binding relationship table, and determines whether the received IP session packet is From the preset MAC address or access port, that is, whether the IP session is an IP session that meets the authentication requirement initiated by the authenticated port.

The binding relationship table is specifically a binding relationship between the IP session identifier generated by the user equipment and the user equipment MAC address or the access port.

The access port may be an access physical port (such as a digital subscriber line port or a passive optical network physical interface), or an access logical port (such as a virtual local area network port or a Gigabit passive optical network encapsulation mode port).

When the network gateway determines that the IP session identifier and the MAC address or the access port of the user equipment meet the preset binding relationship table, the process proceeds to step S203;

When the network gateway determines that the IP address of the IP address and the access port of the user equipment does not match the preset binding relationship table, the process proceeds to step S204.

Step S203: The network gateway allows 4 passages to pass;

That is, the user equipment that sends the packet is the authenticated user equipment. The packet is secure and allows the packet to pass.

Step S204: The network gateway discards the text.

That is, the user equipment that sends the packet is not the user equipment that has passed the authentication. The packet is discarded because the security of the packet is unknown.

Further, when the IP session is a dynamic IP session, the foregoing method further includes: When the IP session is terminated, the IP session ID is released.

The technical solution of the embodiment of the present invention has the following advantages, because the method for filtering the IP session is implemented by verifying whether the IP session identifier generated according to the preset rule is added in the IP session, thereby achieving the IP session in the data. The communication process establishes a coupling relationship with the authentication process/IP address allocation process to improve the security of the IP session.

Corresponding to the technical solution of the first embodiment of the present invention, the second embodiment of the present invention provides an IP session processing system, and FIG. 3 is a schematic structural diagram of an IP session processing system according to Embodiment 2 of the present invention. Shown, including user equipment 1 and network gateway 2:

The user equipment 1 is configured to receive an IP session identifier generation rule sent by the network gateway 2, generate a corresponding IP session identifier according to the IP session identifier generation rule, and send an IP session message to the network gateway 2; further, the user equipment 1 further uses Set the IP session address or IP session address prefix to provide the basis for generating the IP session identifier.

The network gateway 2 is configured to set an IP session identifier generation rule, and send an IP session identifier generation rule to the user equipment 1, and generate an IP session identifier for the IP session in the authentication process and/or the IP address allocation process according to the IP session identifier generation rule. The IP session is filtered according to the IP session identifier. The network gateway 2 specifically includes:

The setting module 21 is configured to set an IP session identifier generation rule and a binding relationship table in the network gateway 2; the sending module 22 is configured to send the IP session identifier generation rule set by the setting module 21 to the user equipment 1 to enable the user equipment 1 Set the IP session ID generation rule.

The generating module 23 is configured to generate an IP session identifier for the IP session in the authentication process and/or the IP address allocation process according to the IP session identifier generation rule preset by the setting module 21, where the module specifically includes: an obtaining submodule 231, configured to: Obtain an IP session address prefix by using an address assignment prefix or by using a router advertisement, or obtain an authentication identifier in an authentication confirmation message, or obtain an execution identifier in an address allocation response message, or obtain an IP session address preset in the user equipment 1 or IP session address prefix; The generating sub-module 232 is configured to: according to the IP session address prefix acquired by the obtaining sub-module 231, or an authentication identifier, or an execution identifier, or an IP session address or an IP session address prefix preset in the user equipment 1, according to the setting module 21 Pre-set IP session ID generation rules to generate IP session IDs for IP sessions;

The update sub-module 233 is configured to allocate an execution identifier in the response message according to the updated IP address obtained by the obtaining sub-module 231 according to the IP session identifier generation rule preset by the setting module 21 when the IP address allocation result of the IP session is updated. Generate an updated IP session ID for the IP session.

The processing module 24 is configured to filter the received IP session packet according to the IP session identifier. Processing module 24 can include:

The determining sub-module 241 is configured to determine whether the IP session identifier and the MAC address or the access end of the user equipment 1 meet the binding relationship table set by the setting module 21;

The filtering sub-module 242 is configured to allow the packet to pass if the determining that the IP session identifier and the MAC address or the access end of the user equipment 1 meet the preset binding relationship table; and if the determining sub-module 241 determines the IP session When the MAC address of the user equipment 1 or the access terminal does not match the preset binding relationship table, the packet is discarded.

The release module 25 is configured to release the IP session identifier generated by the generating module 23 when the IP session is terminated.

The above modules may be distributed in one device or distributed in multiple devices. The above modules can be combined into one module, or further split into multiple sub-modules.

The technical solution of the embodiment of the present invention has the following advantages, because the system for filtering the IP session is implemented by checking whether the IP session identifier generated according to the preset rule is added in the IP session, thereby achieving the IP session in the data. The communication process establishes a coupling relationship with the authentication process/IP address allocation process to improve the security of the IP session.

Corresponding to the technical solution proposed in the first embodiment of the present invention, the present invention proposes an IP session identification method in a dynamic IPv6 session by using the third embodiment, which performs IP in the authentication phase. The creation of the session identifier, the specific method flow chart shown in Figure 4, includes the following steps:

Step S401: The subscriber (Subscriber) device performs an Extensible Authentication Protocol (EAP) authentication through the BNG to the authentication server.

The BNG is the network gateway mentioned in the foregoing embodiment of the present invention. The user equipment is a subscriber in a specific application environment, and may be specifically an access user terminal or a network connected to multiple terminals. The access device, such as the home gateway, is also consistent in the following embodiments, and will not be repeatedly described later. The change of the specific name does not affect the protection scope of the present invention.

Step S402: When the EAP authentication of the user equipment is successful, the EAP Success message is sent by the authentication server to the user equipment through the BNG, and the IPv6 session ID generation rule is configured in the user equipment corresponding to the user.

Step S403: After the EAP authentication of the user equipment is successful, the user equipment starts a DHCP prefix delegation (Prefix Delegation, hereinafter referred to as PD), and generates a DHCP Transaction ID (referred to as xid), and the user equipment can press a certain EAP Identifier according to the EAP Success message. The rule generates xid. If the protocol for carrying Authentication for Network Access (PANA) is used, the xad can be generated according to the PANA Session ID according to a certain rule;

Step S404: The user equipment applies for an IPv6 address prefix through the DHCP PD, and the xid of all DHCP messages remains unchanged during the IPv6 address prefix delegation process.

It should be noted that, due to the lack of a Session ID negotiation process like PPP before the DHCP PD process, the xid is equivalent to the IP Session ID, which is consistent in the lifetime of the same IP session. If the IPv6 address prefix is re-authenticated to the user equipment. Renumbering means that an old IP Session is updated to a new IP Session, and xid will also change with the new IP Session.

Step S405: When the IPv6 address prefix is successfully delegated, the DHCP server sends the IPv6 address prefix to the user equipment by using a DHCP Reply message. Step S406: The BNG and the user equipment may use the IPv6 address prefix delegated by the DHCP Reply message as the IPv6 Session ID.

The IPv6 address prefix is bound to the IPv6 session. In addition, the IPv6 session ID can be bound to the MAC address of the user equipment or the access port to form a binding relationship table.

It should be noted that if the IPv6 address prefix is reassigned to the Subscriber, it is considered that an old IP Session is updated to a new IP Session, and the IP Session ID will also be reassigned by the new IPv6 address prefix by the new DHCP Reply. The message is triggered.

Step S407: The BNG filters the IPv6 Session ID of the received IPv6 packet.

The BNG filters the packets of the IP session according to the preset IPv6 session ID and the MAC address of the user device or the access port. The BNG checks the preset binding relationship table to determine the packets of the received IP session. Whether it comes from a preset MAC address or access port.

When the network gateway determines that the packet of the received IP session is from a preset MAC address or an access port, it determines that the user equipment that sends the packet is the authenticated user equipment, and the BNG allows the packet sent by the user equipment to pass the packet. .

When the network gateway determines that the received IP session packet is not from a preset MAC address or an access port, the BNG discards the packet.

Correspondingly, the user equipment that sends the packet is not the user equipment that has passed the authentication, and the BNG directly discards the packet. It should be further noted that, in the following embodiments, the process of filtering the IPv6 Session ID of the received IPv6 packet by the BNG is consistent with this step, and will not be repeatedly described later.

Step S408: Perform data communication by using a data stream carrying an IPv6 Session ID.

In the data communication phase, the IPv6 data packets carry the IPv6 session ID generated according to the IPv6 session ID generation rule determined after the authentication succeeds.

In step S409, the data communication state survival monitoring is performed by using a keep alive of the IPv6 session ID. The IPv6 Session IDs generated by the IPv6 Session ID generation rules are determined by the IPv6 Session ID generation rule.

It should be noted that, in step S408 and step S409, there is no necessary time-order relationship in the specific implementation environment, and the change of the two-step sequence does not affect the protection scope of the present invention.

Step S410: The IPv6 address prefix is released or renumbered.

When the IPv6 address prefix is released or re-allocated, it is considered that an old IP session is updated to a new IP session, that is, the current IPv6 session is terminated.

Step S411: The IPv6 Session ID is released.

The technical solution of the embodiment of the present invention has the following advantages, because the IP session is generated by verifying whether an IP session identifier generated according to a preset rule is added in the IP session, thereby realizing the IP session in the data communication process. Establish a coupling relationship with the authentication process/IP address allocation process to improve the security of the IP session.

Corresponding to the technical solution proposed in the first embodiment of the present invention, the present invention proposes another IP session identification method in a dynamic IPv6 session by using the fourth embodiment, which implements the creation of an IP session identifier in the IP address allocation phase. The method flowchart is as shown in FIG. 5, and includes the following steps: Step S501: The user equipment performs EAP authentication by using the BNG to the authentication server.

Step S502: When the EAP authentication of the user equipment is successful, the EAP Success message is sent by the authentication server to the user equipment through the BNG, and the IPv6 session ID generation rule is configured in the user equipment.

Step S503: After the EAP authentication of the user equipment is successful, the user equipment starts SLAAC, and

The BNG issues a Router Solicitation (RS) message;

Step S504: After receiving the RS message, the BNG sends a Router Advertisement (RA) message to the user equipment.

The source address of the RA message is the IPv6 address of the BNG, and the RA message contains the IPv6 address prefix. Step S505: The BNG and the user equipment may use the IPv6 address prefix carried by the RA message as IPv6 Session ID;

That is, the IPv6 address prefix is bound to the IPv6 session. Further, the IPv6 session ID can be bound to the user equipment MAC address or the access port to form a binding relationship table.

It should be noted that if the IPv6 address prefix is reassigned to the Subscriber, it is considered that an old IP Session is updated to a new IP Session, and the IP Session ID will also be reassigned by the new IPv6 address prefix by the new RA message. Trigger generation.

Step S506: The BNG filters the IPv6 session ID of the received IPv6 packet. Step S507: Perform data communication by using the data stream carrying the IPv6 session ID.

Step S508: Perform data communication state survival monitoring by using a keep alive of the IPv6 session ID.

The IPv6 Session ID of the IPv6 Session is generated by the IPv6 Session ID generation rule.

It should be noted that, in step S507 and step S508, there is no inevitable chronological relationship in the specific implementation environment, and the change of the two step sequences does not affect the protection scope of the present invention.

Step S509: The IPv6 address prefix is released or re-allocated (renumbering);

Step S510: The IPv6 Session ID is released.

Corresponding to the technical solution proposed in the first embodiment of the present invention, the present invention is provided by the fifth embodiment. An IP session identification method in another dynamic IPv6 session is provided. The method creates an IP session identifier in the IP address allocation phase. The flowchart of the specific method is as shown in FIG. 6, and includes the following steps: Step S601: The user equipment passes the BNG. Go to the authentication server for EAP authentication;

Step S602: When the user equipment EAP authentication succeeds, the EAP Success message is sent by the authentication server to the user equipment through the BNG, and the IPv6 session ID generation rule is configured in the user equipment. Step S603, the BNG, and the user equipment generate rules according to the IPv6 session ID. Generate an IPv6 Session ID for the BNG and the user equipment.

The BNG and the user equipment can generate an IPv6 Session ID according to the EAP Identifier of the EAP Success message according to a certain rule. If PANA is used, the IPv6 Session ID can be generated according to a certain rule according to the PANA Session ID.

Step S604: The BNG filters the IPv6 session ID of the received IPv6 packet. Step S605: The user equipment applies for an IPv6 address by using a stateless or stateful address allocation method. In the IPv6 address allocation process, all uplink messages are carried according to IPv6 Session ID generated by the IPv6 Session ID generation rule after the authentication succeeds.

Step S606: Perform data communication by using a data stream carrying an IPv6 Session ID.

Step S607: Perform data communication state survival monitoring by using a keep alive of the IPv6 session ID.

It should be noted that, in step S606 and step S607, there is no necessary time-order relationship in the specific implementation environment, and the change of the two-step sequence does not affect the protection scope of the present invention.

Step S608, the IPv6 address is released;

Step S609, the IPv6 session is terminated, and the IPv6 session ID is released. The technical solution of the embodiment of the present invention has the following advantages, because the method for filtering the IP session is implemented by verifying whether the IP session identifier generated according to the preset rule is added in the IP session, thereby achieving the IP session in the data. The communication process establishes a coupling relationship with the authentication process/IP address allocation process to improve the security of the IP session.

Corresponding to the technical solution proposed in the first embodiment of the present invention, the present invention proposes another IP session identification method in a dynamic IPv6 session by using the sixth embodiment. The method creates an IP session identifier in the IP address allocation phase, specifically The method flowchart is as shown in FIG. 7, and includes the following steps: Step S701: The user equipment performs EAP authentication by using the BNG to the authentication server.

Step S702: When the EAP authentication of the user equipment is successful, the EAP Success message is sent by the authentication server to the user equipment through the BNG, and the IPv6 session ID generation rule is configured.

Step S703: After the user equipment EAP is successfully authenticated, the user equipment initiates a stateful address allocation, and generates a DHCP Transaction ID (xid for short); the user equipment may generate a xid according to a certain rule according to the EAP Identifier of the EAP Success message; if PANA is used, It is also possible to generate xid according to a certain rule according to the PANA Session ID;

Step S704: The user equipment applies for an IPv6 address by using a stateful address allocation manner, and the xid of all DHCP messages remains unchanged during the IPv6 address allocation process.

It should be further pointed out that since there is a lack of Session ID negotiation process like PPP before the DHCP address allocation process, xid is equivalent to the IP Session ID, and it is recommended to be consistent in the lifetime of the same IP Session; if the DHCP process passes the reconfigure message If the IP address is replaced, it is considered that an old IP session is updated to a new IP session, and xid will also change with the new IP session.

Step S705: When the IPv6 address is successfully applied, the DHCP server sends an IPv6 address to the user equipment by using a DHCP Reply message.

Step S706: The BNG and the user equipment may generate an IPv6 Session ID according to a DHCP Traaction ID of the DHCP Reply message according to a certain rule. It should be further pointed out that if the DHCP process replaces the IP address through the reconfigure/renew message, it is considered that the old IP Session is updated to the new IP Session, and the IP Session ID will also be re-allocated with the new IP address by the new IP address. A DHCP Reply message is triggered.

Step S707: The BNG filters the IPv6 session ID of the received IPv6 packet. Step S708: Perform data communication by using the data stream carrying the IPv6 session ID.

In the data communication phase, the IPv6 data packet carries the IPv6 Session ID generated according to the IPv6 Session ID generation rule determined after the authentication succeeds.

Step S709: Perform data communication state survival monitoring by using a survival monitoring packet carrying an IPv6 session ID.

It should be noted that, in step S708 and step S709, there is no necessary time-order relationship in the specific implementation environment, and the change of the two-step sequence does not affect the protection scope of the present invention.

Step S710: The IPv6 address is released.

Step S711: The IPv6 session is terminated and the IPv6 session ID is released.

Corresponding to the technical solution proposed in the first embodiment of the present invention, the present invention proposes another IP session identification method in a dynamic IPv6 session by using the seventh embodiment. In the method, the IP address allocation phase and the authentication phase are merged. The method performs the creation of the IP session identifier at this stage. The flowchart of the specific method is shown in FIG. 8, and includes the following steps:

Step S801, the user equipment generates a DHCP Transaction ID (referred to as xid);

Step S802: The user equipment passes the DHCP authentication to implement user equipment authentication and a stateful address. Allocation, during the DHCP authentication process, the xid of all DHCP messages remains unchanged; it needs to be further pointed out that due to the lack of PPP before the DHCP address allocation process

The session ID negotiation process, so xid is equivalent to the IP session ID. It is recommended to be consistent in the lifetime of the same IP session. If the DHCP process replaces the IP address through the reconfigure/renew message, it is considered to be updated by an old IP session. IP Session, xid will also follow the new

The IP Session is changed.

Step S803: When the DHCP authentication succeeds, the BNG sends the IPv6 address to the user equipment by using the DHCP Reply message to notify the user that the device is successfully authenticated, and configures an IPv6 session ID generation rule.

Need to point out further, if the DHCP process is replaced by a reconfigure/renew message

The IP address is considered to be updated by a new IP session to a new IP session. The IP session ID will also be triggered by a new DHCP Reply message as the new IP address is reassigned.

Step S804: The BNG and the user equipment may generate an IPv6 Session ID according to the DHCP Transaction ID of the DHCP Reply message according to the IPv6 Session ID generation rule determined after the authentication succeeds.

Step S805: The BNG filters the IPv6 Session ID of the received IPv6 packet. Step S806: Perform data communication by using the data stream carrying the IPv6 Session ID.

In the data communication phase, IPv6 data packets carry IPv6 determined according to the successful authentication.

The IPv6 Session ID generated by the session ID generation rule.

Step S807: Performing data communication state survival monitoring by using a surviving monitoring packet carrying an IPv6 session ID;

The IPv6 Session IDs generated by the IPv6 Session ID generation rules are determined by the IPv6 Session ID generation rule. It should be noted that, in step S806 and step S807, there is no necessary time-order relationship in the specific implementation environment, and the change of the two step sequences does not affect the protection scope of the present invention.

Step S808: The IPv6 address is released.

Step S809: The IPv6 session is terminated, and the IPv6 session ID is released.

Corresponding to the technical solution proposed in the first embodiment of the present invention, the present invention proposes an IP session identification method in a static IPv6 session by using the eighth embodiment. In this method, since it is a static IPv6 session, there is no authentication phase. In the IP address allocation phase, the method is to create an IP session identifier at this stage. The flowchart of the specific method is as shown in FIG. 9. The method includes the following steps: Step S901: The network statically configures the IPv6 address/address prefix of the user equipment. And an IPv6 Session ID generation rule;

Step S902: The BNG and the user equipment generate an IPv6 session ID according to the pre-configured IPv6 session ID generation rule according to the IPv6 address/address prefix of the user equipment.

Step S903: The BNG filters the IPv6 session ID of the received IPv6 packet. Step S904: Perform data communication by using the data stream carrying the IPv6 session ID.

In step S905, the data communication state survival monitoring is performed by using a keep alive of the IPv6 session ID.

It should be noted that step S904 and step S905 are not necessary in a specific implementation environment. The chronological relationship, the change of the order of the two steps does not affect the scope of protection of the present invention. The technical solution of the embodiment of the present invention has the following advantages, because the method for filtering the IP session is implemented by verifying whether the IP session identifier generated according to the preset rule is added in the IP session, thereby achieving the IP session in the data. The communication process establishes a coupling relationship with the authentication process/IP address allocation process to improve the security of the IP session.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by hardware, or can be implemented by means of software plus necessary general hardware platform, and the technical solution of the present invention. It can be embodied in the form of a software product that can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including a number of instructions for making a computer device (may It is a personal computer, a server, or a network device, etc.) that performs the methods described in various embodiments of the present invention.

A person skilled in the art can understand that the drawings are only a schematic diagram of a preferred embodiment, and the modules or processes in the drawings are not necessarily required to implement the invention. The above description is only a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. The scope of protection of the invention should be considered.

Claims

Rights request

An IP session identification method, comprising:

The IP session identification method according to claim 1, wherein the filtering the received IP session packet according to the IP session identifier is:

Determining whether the IP session identifier and the MAC address or the access port of the user equipment meet the preset binding relationship table;

If the IP session identifier and the user equipment's MAC address or the access port meet the preset binding relationship table, permit the IP session packet to pass; if the IP session identifier and the user equipment's MAC address or When the access port does not meet the preset binding relationship table, the IP session packet is discarded.

The IP session identification method according to claim 1 or 2, wherein the generating an IP session identifier for the IP session in the authentication process and/or the IP address allocation process according to the preset IP session identifier generation rule Previously, the method further includes the step of setting the IP session identification generation rule:

When the IP session is a dynamic IP session, the IP session identifier generation rule is set locally, and the IP session identifier generation rule is set in the user equipment by sending an authentication confirmation message or an address assignment response message to the user equipment. .

The IP session identification method according to claim 3, wherein the generating an IP session identifier for the IP session in the authentication process and/or the IP address allocation process according to the preset IP session identifier generation rule is specifically :

According to the preset IP session identifier generation rule, according to the IP session address prefix obtained by the address assignment prefix delegation or by the router advertisement, or the authentication identifier in the authentication confirmation message, or the address allocation response message Execution ID, assigned during the authentication process and / or IP address The IP session identifier is generated for the IP session.

The method for identifying an IP session according to claim 4, wherein the generating the rule according to the preset IP session identifier, according to the execution identifier in the address allocation response message, in the authentication process and/or After the IP session identifier is generated for the IP session in the IP address allocation process, the method further includes:

And when the IP address allocation result of the IP session is updated, generating an updated IP session identifier for the IP session according to the preset IP session identifier generation rule according to the execution identifier in the updated address allocation response message.

When the IP session is a static IP session, the IP session identification generation rule is set locally and the user equipment.

The IP session identification method according to claim 6, wherein the generating an IP session identifier for the IP session in the authentication process and/or the IP address allocation process according to the preset IP session identifier generation rule is specifically :

And generating, according to the preset IP session identifier generation rule, an IP session identifier for the IP session in the IP address allocation process according to the obtained IP session address or IP session address prefix preset in the user equipment.

The IP session identification method according to claim 1, wherein the IP session identifier is a flow label or an IP address prefix of the IP session text.

The IP session identification method according to claim 1, wherein the IP session identifier is carried in an AAA message of the IP session, and the IP edge node performs authorization of the IP session according to the IP session identifier.

10. The IP session identification method according to claim 4, wherein, according to said The method further includes: when the IP session identifier is generated by the address assignment prefix or the IP session address prefix obtained by the router, and the IP session identifier is generated for the IP session during the authentication process and/or the IP address allocation process, the method further includes:

The IP session identifier is released when the IP session address prefix is released or reassigned.

The method for identifying an IP session according to claim 3, wherein when the IP session is a dynamic IP session, the method further includes:

When the IP session is terminated, the IP session identifier is released.

12. A network gateway, comprising:

The processing module is configured to filter, according to the IP session identifier, the received IP session packet.

The network gateway according to claim 12, wherein the processing module comprises: a determining sub-module, configured to determine whether the IP session identifier and the MAC address or the access port of the user equipment meet the preset binding Relationship table

a filtering submodule, configured to: if the determining submodule determines the IP session identifier and the user equipment

When the MAC address or the access port meets the preset binding relationship table, the packet is allowed to pass; if the determining sub-module determines that the IP session identifier and the MAC address or the access port of the user equipment do not meet the preset When the relationship table is bound, the packet is discarded.

The network gateway according to claim 12 or 13, further comprising: a setting module, configured to locally set the IP session identifier generation rule and the binding relationship table; and a sending module, configured to The IP session identifier generation rule set by the setting module is sent to the user equipment to set the IP session identifier generation rule in the user equipment.

The network gateway according to claim 12 or 13, further comprising: a release module, configured to release an IP session identifier generated by the generating module when the IP session is terminated.

The network gateway according to claim 12 or 13, wherein the generating module The block specifically includes:

Obtaining a sub-module, configured to obtain an IP address prefix by using an address assignment prefix or by using a router advertisement, or obtaining an authentication identifier in an authentication confirmation message, or obtaining an execution identifier in an address allocation response message, or acquiring the user equipment a preset IP session address or IP session address prefix;

Generating a sub-module, configured to use the IP session address prefix obtained by the obtaining sub-module, or the authentication identifier, or the execution identifier, or an IP session address or an IP session preset in the user equipment The IP prefix identifies an IP session identifier for the IP session according to the IP session identifier generation rule preset by the setting module.

The network gateway according to claim 16, wherein the generating module further comprises:

And an update submodule, configured to: when the IP address allocation result of the IP session is updated, perform an execution according to the IP session identifier generation rule set by the setting module, according to the updated address allocation response message acquired by the obtaining submodule An identifier that generates an updated IP session identifier for the IP session.

An IP session processing system, comprising: a user equipment and a network gateway: the user equipment, configured to receive an IP session identifier generation rule sent by the network gateway, and generate a corresponding according to the IP session identifier generation rule IP session identifier, and sending an IP session message to the network gateway;

The network gateway is configured to set the IP session identifier generation rule, and send the IP session identifier generation rule to the user equipment, according to the IP session identifier generation rule in an authentication process and/or an IP address allocation process. Generating an IP session identifier for the IP session, and filtering the IP session according to the IP session identifier.

The IP session processing system according to claim 18, wherein the user equipment and the network gateway release the IP session identifier after the IP session ends.